JP2007074383A - Information system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information system capable of quickly and surely detecting and coping with an illegitimate access. <P>SOLUTION: The information system discriminates whether or not traffic related to packet information transmitted from a switch 10 is abnormal on the basis of index information denoting features of the traffic in an ordinary operation and controls the transfer rate of a communication port of the switch 10 with relative to the traffic discriminated to be abnormal. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an information system, and more particularly to an information system that monitors traffic flowing on a network.

  With the spread of open information networks such as the Internet, unauthorized access such as unauthorized intrusion and denial of service attack (Dos Attack) by malicious persons has become a security problem. In a conventional information network, unauthorized access is prevented by providing a device that can perform access control such as a firewall on the network path in response to the above-described security problems (for example, patents). Reference 1).

Hereinafter, the network configuration of the conventional information system 100 will be described with reference to FIGS.
As shown in FIG. 10, the information system 100 includes a switch 10a, 10b, and 10c that configures a network segment in the internal network LAN and transfers packets transmitted from each terminal 20, and the internal network LAN and the external network WAN. A firewall FW that controls packet transmission / reception (access control), an internal network LAN, and a router 30 that relays packet transfer between external networks WAN. The internal network LAN and external network WAN are connected via a network N. So that they can communicate with each other. In addition, the rectangle shown in the switch means the physical communication port which the said switch has, and the numerical value in a rectangle means the identification number for identifying each port.

FIG. 11 is a flowchart illustrating an operation when unauthorized access is detected by the firewall FW of the information system 100.
When the firewall FW receives a packet transmitted from the external network WAN (step S61), the firewall FW has an access control table (for example, a transmission source and / or a transmission destination device) in which a security policy between the internal network LAN and the external network WAN is defined in advance. (Table in which IP addresses, TCP / UDP port numbers, and the like are associated with each other) are determined (Step S62), and it is determined whether or not a series of traffic related to this packet is permitted (Step S63). If it is determined that the communication is not permitted and abnormal (step S13; No), the packet is discarded (step S64), and the process ends. On the other hand, when it is determined that the permitted traffic is normal (step S63; Yes), the packet is transferred to the internal network (step S65), and the process ends.

  Further, a network system that detects unauthorized access at the end of the network by introducing unauthorized detection software that detects unauthorized access to each terminal 20 connected to the information system 100 has been proposed (for example, Patent Document 2). reference).

FIG. 12 is a flowchart showing an operation when unauthorized access is detected by each terminal 20 of the information system 100.
When the terminal 20 receives a packet from the switch 10a, 10b, or 10c (step S71), the terminal 20 determines whether or not there is an abnormality in the traffic related to the packet (step S72). Here, when it is determined that there is an abnormality (step S72; No), this packet is discarded (step S73), and this process ends. On the other hand, when it is determined that there is no abnormality (step S72; Yes), predetermined processing is executed based on this packet (step S74), and this processing ends.

On the other hand, also in the field of plant information systems related to plant control such as factory facilities, information transmission / reception using TCP / IP technology has recently been performed, and security problems similar to the information systems described above are being used. There are concerns. In particular, in a plant information system, maintenance of availability is indispensable because economic loss such as production stoppage is significant.
JP 2005-124055 A JP 2004-54470 A

  However, in the system configuration using the conventional firewall, since only traffic passing between the internal network LAN and the external network WAN is subject to access control, unauthorized access occurring in the internal network LAN cannot be detected. Since it is impossible to deal with unauthorized access, it is difficult to maintain system availability.

  In addition, in the configuration in which unauthorized access is detected at a terminal, it is necessary to install unauthorized access detection software on each terminal, which increases the cost. In addition, since the computing resources of each terminal are limited, it may be difficult to add a function for detecting unauthorized access. In addition, the physical location of the terminal where unauthorized access is detected (which communication port of which switch is connected) cannot be determined, and the response may be delayed, so system availability can be maintained. Have difficulty.

  Furthermore, the conventional technology such as the firewall described above determines whether or not the unauthorized access is based on a packet of a single or limited session, so that an access point such as a wireless device provided in the internal network LAN, or a switch It cannot be detected that unauthorized access has been made through the entrance (back door), and cannot be an effective method for unauthorized access within the internal network. For this reason, it is necessary to monitor traffic between terminals, including intrusion traffic from the entrance (back door) in an internal network such as a wireless access point. However, operations that cause irregular transmission / reception from unspecified terminals. In general information systems such as offices that have a typical traffic environment, it is difficult to determine the probability of an index when judging an abnormality due to its dynamic traffic characteristics. There is a problem that can not be.

  An object of the present invention is to provide an information system capable of quickly and reliably detecting and responding to unauthorized access.

In order to solve the above-mentioned problem, the invention described in claim 1
Switching means for transferring packets transmitted from one or a plurality of terminals respectively connected to a plurality of communication ports to other terminals, packet information generating means for generating packet information relating to the transmitted packets, and the generated An information system comprising: a network device provided with packet information transmitting means for transmitting the packet information; and a traffic collection server for storing packet information transmitted from the network device,
The collection server stores index information storage means for storing index information indicating characteristics of traffic during normal operation, and traffic related to the packet information based on the stored index information and the received packet information. An abnormality determination unit that determines whether or not there is an abnormality, and an abnormality response that generates instruction information for changing the transfer speed of the communication port of the network device related to the traffic determined to be abnormal by the abnormality determination unit, and transmits the instruction information to the network device Means, and
The transfer means controls the transfer speed of the communication port indicated by the instruction information based on the instruction information from the abnormality handling means.

Furthermore, the invention according to claim 2 is the invention according to claim 1,
The collection server includes a traffic analysis unit that generates the index information from the stored packet information and stores the index information in the index information storage unit.

Furthermore, the invention according to claim 3 is the invention according to claim 1 or 2,
The packet information includes identification information of a network device that has generated the packet information, identification information of a communication port in which the packet is transmitted and / or received in the network device, identification information of a transmission source terminal and a reception destination terminal of the packet, It includes at least information on a packet size of the packet, header information included in a header portion of the packet, a time stamp indicating a generation date and time of the packet information, and a protocol type of the packet.

Furthermore, the invention according to claim 4 is the invention according to claim 1, wherein the index information is an upper limit value and / or a lower limit value of the number of packets transmitted and / or received at a specific communication port in the network device. Including any or all of an upper limit value and / or a lower limit value of a transfer rate when a packet is transmitted and / or received at a specific communication port, and identification information of the terminal connected to the specific communication port. It is a feature.

Furthermore, the invention according to claim 5 is the invention according to claim 1 or 4, wherein the index information is an upper limit value of the number of packets transmitted and / or received between specific terminals among the plurality of terminals. And / or a lower limit value, and any or all of an upper limit value and / or a lower limit value of a transfer rate when a packet is transmitted and / or received between the specific terminals.

Furthermore, the invention according to claim 6 is the invention according to claim 1, 4 or 5,
The index information includes a setting related to transmission and / or reception of the packet predetermined between specific terminals among the plurality of terminals.

Further, the invention according to claim 7 is the invention according to claim 1,
The network device comprises a packet sampling means for extracting one packet from a packet transmitted from the terminal at a predetermined timing,
The packet information generation means generates packet information of the extracted packet.

  According to the first aspect of the present invention, it is determined whether or not the traffic related to the packet information transmitted from the network device is abnormal based on the index information indicating the characteristics of the traffic during normal operation, and is determined as abnormal. The transfer speed of the communication port of the network device related to the traffic is controlled. Thereby, since it is possible to detect and respond to unauthorized access quickly and reliably, the availability of the system can be maintained.

  According to the invention described in claim 2, the index information is generated from a plurality of pieces of packet information. Thereby, the index information according to the traffic environment of the network to which the information system is applied can be generated.

  According to the third aspect of the present invention, the packet information includes the identification information of the network device that generated the packet information, the identification information of the communication port at which the packet is transmitted and / or received in the network device, and the transmission source of the packet And identification information of the receiving terminal, the packet size of the packet, header information included in the header of the packet, a time stamp indicating the generation date and time of the packet, and information regarding the protocol type of the packet.

  According to the fourth aspect of the present invention, the upper limit value and / or lower limit value of the number of packets transmitted and / or received at a specific communication port in the network device, and packets are transmitted and / or received at the specific communication port. Whether or not the traffic is abnormal can be determined based on any or all of the upper limit value and / or lower limit value of the transfer rate and the identification information of the terminal connected to the specific communication port.

  According to the fifth aspect of the present invention, when an upper limit value and / or a lower limit value of the number of packets transmitted and / or received between specific terminals is transmitted and / or received between the specific terminals. Whether or not the traffic is abnormal can be determined based on any or all of the upper limit value and / or the lower limit value of the transfer rate.

  According to the sixth aspect of the present invention, it is possible to determine whether or not the traffic is abnormal based on a setting relating to transmission and / or reception of a predetermined packet among a plurality of terminals.

  According to the seventh aspect of the present invention, since packet information can be generated based on one packet extracted at every predetermined timing, the load on the network device can be suppressed.

  The best mode for carrying out the present invention will be described below in detail with reference to the drawings. However, the scope of the invention is not limited to the illustrated examples.

<First Embodiment>
First, the configuration of the information system 100 in the present embodiment will be described with reference to FIG. The information system 100 in this embodiment is a plant information system that performs plant operation monitoring and control, and a terminal (node) 20 connected to the switch 10a, 10b, or 10c in the internal network LAN is: It is assumed that the device is a field device installed in a plant, a PC (Personal Computer) or a server that collects various plant data output from the field device and performs operation monitoring. Here, the field device means a measuring device such as a temperature sensor, a pressure sensor, a flow rate sensor, and an adjusting device such as a valve switch or a thermal power adjuster, and a measurement amount measured by the field device, A process amount such as an adjustment amount indicating the degree of adjustment is output as process data.

  As shown in FIG. 1, the information system 100 forms a network segment in the internal network LAN, transfers a packet transmitted from each terminal 20 to other terminals 20, and generates and transmits statistical information related to the packet. Statistical information transmitted from the switches 10a, 10b, and 10c (hereinafter, the switches 10a, 10b, and 10c are collectively referred to as the switch 10), the router 30 that relays packet transfer between the internal network LAN and the external network WAN, and the switch 10 It comprises a traffic collection server 40 etc. that receives and manages. The internal network LAN and the external network WAN are connected via a network N so that they can communicate with each other. Note that communication on the information system 100 is performed in a format compliant with the TCP / IP technology, and the format may be either IPv4 or IPv6. Further, encrypted communication such as IPSec (Security Architecture for Internet Protocol) may be performed.

  Here, each device included in the information system 100 is assigned a unique IP address, and information can be transmitted and received between the devices based on the TCP / IP technology. In addition, the rectangle shown in each switch 10 means the physical communication port which the said switch has, and the numerical value in a rectangle means the identification number for identifying each communication port.

FIG. 2 is a diagram illustrating an internal configuration of the switch 10.
As shown in the figure, the switch 10 includes a packet sampling unit 11, a packet information generation unit 12, a packet information transmission unit 13, a switching unit 14, and the like.

  The packet sampling unit 11 extracts (samples) one packet from a plurality of packets transmitted from the terminal 20 at a predetermined timing (for example, one packet per 500 packets), and outputs it to the packet information generation unit 12. Note that other packets not extracted by the packet sampling unit 11 are output to the switching unit 14 via the packet sampling unit 11.

  The packet information generation unit 12 generates packet information relating to the packet input from the packet sampling unit 11 and outputs the packet information to the packet information transmission unit 13, and outputs the packet input from the packet sampling unit 11 to the packet information transmission unit 13. .

  Here, the packet information is information generated based on information included in the header portion of the packet, and the IP (Internet Protocol) address of the switch 10 that generated the packet information, and the switch 10 transmits the packet. And / or the communication port identification number of the received communication port, the IP address and MAC (Media Access Control) address of the source and destination terminals of this packet, the packet size of the packet, and the IP included in the header of the packet It includes header information, a time stamp indicating the generation date and time of the packet, information on the protocol type (TCP / UDP port number) of the packet, and the like. The packet information may include statistical information indicating the operating state of the switch 10 (each communication port). Here, the statistical information is information generated based on a management information database such as MIB (Management Information Base) conforming to traffic monitoring technology such as SNMP (Simple Network Management Protocol). In the present embodiment, It is generated by the packet information generation means 12.

  The packet information transmission unit 13 transmits the packet information generated by the packet information generation unit 12 to the traffic collection server 40 and outputs the packet input from the packet information generation unit 12 to the switching unit 14. In addition, as a series of mechanisms related to the transmission (collection) of packet information described above, a technology based on rules such as sFlow (RFC3176) and NetFlow (registered trademark) can be used.

  The switching unit 14 sends the packet to the receiving terminal based on various information included in the header part (Ethernet (registered trademark) header, IP header, and TCP header) of the packet input from the packet sampling unit 11 and the packet information transmission unit 13. And forward. At this time, it is assumed that the transfer is performed via a communication port connected to the receiving terminal or another switch that can transfer to the receiving terminal.

  The switching unit 14 controls the transfer speed of the communication port indicated by the instruction information based on the instruction information transmitted from the abnormality handling unit 47 of the traffic collection server 40 in the traffic monitoring process described later.

Next, the traffic collection server 40 will be described with reference to FIG.
FIG. 3 is a diagram showing an internal configuration of the traffic collection server 40.
As shown in the figure, the traffic collection server 40 has control means 41, display means 42, operation means 43, storage means 44, traffic analysis means 45, abnormality determination means 46, abnormality response means 47, communication means 48, and the like. Each part is connected via a control bus 49.

  The control means 41 is composed of a CPU (Central Processing Unit), a RAM (Random Access Memory), etc. (not shown), reads various control programs stored in the storage means 44, and develops them in a work memory formed in the RAM. The operation of each unit is centrally controlled according to the control program. Further, the control means 41 executes a traffic monitoring process to be described later in cooperation with a control program developed in the RAM.

  The display means 42 is configured by an LCD (Liquid Crystal Display), an ELD (Electro Luminescence Display) panel, or the like, and performs screen display based on display data input from the control means 41.

  The operation unit 43 includes a keyboard, a mouse, and the like provided with a character input key, a numeric input key, and other keys associated with various functions, and outputs an operation signal corresponding to an operation by the user to the control unit 41.

  The storage means 44 has a recording medium (not shown) in which programs, data, and the like are stored in advance, and this recording medium is constituted by a magnetic or optical recording medium or a nonvolatile memory such as a semiconductor. The recording medium is fixedly provided in the storage means 44 or detachably mounted. The recording medium includes a system program corresponding to the traffic collection server 40 and various processing programs that can be executed on the system program. The data processed by these programs are stored. Each of these processing programs is stored in the form of a readable program code, and the control means 41 sequentially executes operations according to the program code.

  In addition, a database 441 for storing and managing packet information transmitted from the switch 10 is constructed in the storage medium of the storage unit 44, and various types of information included in the packet information is stored (stored) in the database 441. ) In this embodiment, the database 441 is provided in the traffic collection server 40. However, the present invention is not limited to this, and the database 441 may be constructed in an external storage unit to which the traffic collection server 40 can be connected. . Further, the storage unit 44 stores the index information 442 generated by the traffic analysis unit 45 in the storage medium.

  The traffic analysis means 45 derives the characteristics of traffic (communication) during steady operation by analyzing a plurality of packet information stored in the database 441 using a statistical method. Here, the normal operation means a time when a predetermined operation (communication) is normally performed by each device in the information system 100.

  Specifically, the traffic analysis means 45 determines the upper limit value and / or lower limit value of the number of packets transmitted and / or received at a specific communication port based on various information included in the packet information, at the specific communication port. The upper limit value and / or lower limit value of the transfer rate when a packet is transmitted and / or received, the MAC address and / or IP address of the terminal 20 connected to a specific communication port, etc. Information related to communication ports is derived as traffic characteristics during normal operation.

  Further, the traffic analysis means 45 is based on various information included in the packet information, and an upper limit value and / or a lower limit value of the number of packets transmitted and / or received between the MAC address or IP address indicating a specific terminal, Information on the communication flow during normal operation, such as the upper limit value and / or lower limit value of the transfer rate when a packet is transmitted and / or received between a MAC address or IP address indicating a specific terminal. Derived as a feature of

  Further, the traffic analysis unit 45 generates index information 442 including the derived traffic characteristics during normal operation, and stores the index information 442 in the storage medium of the storage unit 44. Here, the index information 442 stores various derived characteristics in association with various conditions of the characteristics (for example, the IP address of the switch 10, the communication port identification number, the IP address of the terminal 20, the MAC address, etc.). It is assumed that

  In addition, in the internal network LAN, in a case where predetermined traffic is scheduled to occur between specific terminals 20, settings relating to transmission and / or reception of this packet may be included in the index information 442. Good. For example, when communication between the specific terminals 20 is scheduled to be performed at a predetermined interval (for example, once per minute), between the MAC address or IP address indicating the specific terminal Setting to permit communication, upper limit and / or lower limit of the number of packets transmitted and / or received between the terminals, upper limit of transfer rate when packets are transmitted and / or received between the terminals The index information 442 can include a value and / or a lower limit value.

  In addition, it is preferable that the threshold value (upper limit value and / or lower limit value) of various information included in the index information 442 is set to a value that is assumed to affect maintenance of the availability of the internal network LAN.

  The abnormality determination unit 46 compares the index information 442 stored in the recording medium of the storage unit 44 with the packet information received via the communication unit 48 described later, thereby determining whether the traffic related to the packet information is abnormal. Determine whether or not. In the present embodiment, the function of the abnormality determination unit 46 is realized in cooperation with a predetermined program stored in advance in the recording medium of the control unit 41 and the storage unit 44. However, ASIC (Application Specific It may be realized by a dedicated circuit such as an integrated circuit.

  The abnormality handling unit 47 generates instruction information for changing the transfer rate of the communication port of the switch 10 related to the traffic determined to be abnormal by the abnormality determination unit 46 and transmits the instruction information to the switch 10. Here, as means for changing the transfer rate of the switch 10, diffserv, IEEE802. lq, an IP filter, or the like can be used. In the present embodiment, the function of the abnormality handling means 47 is realized by cooperation with a predetermined program stored in advance in the recording medium of the control means 41 and the storage means 44. It is good also as an aspect implement | achieved by a circuit.

  The communication unit 48 includes a router, a TA (Terminal Adapter), a LAN adapter, and the like, and performs communication control of various types of information exchanged with the switch 10.

Next, packet transfer processing performed by the switch 10 will be described with reference to the flowchart of FIG.
First, a packet is transmitted from one or a plurality of terminals 20, and when this packet is received via a communication port (step S11), one packet from the plurality of packets is sent at predetermined timings by the packet sampling means 11. (Step S12).

  Here, when the packet sampling unit 11 extracts a packet (step S13; Yes), the packet information generation unit 12 generates packet information about the packet (step S14). The packet information transmission unit 13 transmits the packet information to the traffic collection server 40 (step S15). And based on the various information contained in the header part of a packet, this packet is transferred to a receiving terminal by the switching means 14 (step S16), and this process is complete | finished.

  On the other hand, when a packet is not extracted by the packet sampling means 11 (step S13; No), this packet is sent to the receiving terminal by the switching means 14 based on various information included in the header part of the packet. The process is terminated (step S16).

  Next, a traffic monitoring process performed by the traffic collection server 40 will be described with reference to FIG. In the traffic monitoring process of the present embodiment, the upper limit value (thresh_p (PPS: Packet Per Second)) of packets received at a specific communication port included in the index information 442 and packets are received at a specific communication port. This is performed based on the upper limit value of transfer speed (thresh_b (BPS: Bits Per Second)). Each process of the traffic monitoring process is a process executed in cooperation with the control unit 41 and a predetermined program developed in a RAM (not shown).

  First, when the packet information transmitted from the switch 10 is received via the communication means 48 (step S21), the IP address of the switch 10 from which the packet information is generated and the packet related to the packet information are received from the packet information. Is acquired (step S22), the number of packets received by this communication port (Pkts_IN (PPS)), and the transfer rate when the packets are received (Bytes_IN (BPS)) The information regarding is acquired (step S23).

  Next, the upper limit value (thresh_p) and the upper limit value (thresh_b) of the transfer rate corresponding to the communication port identification number of the IP address communication port of the switch 10 acquired in step S22 are read from the index information 442 ( In step S24, the number of packets (Pkts_IN) and the upper limit value (thresh_p) of the packet number, the transfer rate (Bytes_IN), and the upper limit value (thresh_b) of the transfer rate are respectively compared (step S25).

  Here, when it is determined that the packet number information (Pkts_IN) is equal to or less than the upper limit value (thresh_p) of the packet number and the transfer rate information (Bytes_IN) is equal to or less than the upper limit value (thresh_b) of the transfer rate (step S25; Yes), this process ends.

  On the other hand, if it is determined in step S25 that the number of packets (Pkts_IN) exceeds the upper limit value (thresh_p) of the number of packets or the transfer rate (Bytes_IN) exceeds the upper limit value (thresh_b) of the transfer rate (step S25). No), it is determined that the traffic related to the packet information is abnormal (step S26). Then, instruction information for suppressing or stopping the transfer speed (transfer band) of the communication port is transmitted to the switch 10 having the communication port related to the traffic determined to be abnormal (step S27). ), A screen for notifying that unauthorized access has been made from the terminal 20 connected to the communication port of the switch 10 is displayed on the display means 42 (step S28), and this process ends.

  As described above, in order to determine the abnormality of the traffic related to the packet information based on the information about the communication port of the switch 10, when the number of packets exceeding the upper limit value in the normal operation is transmitted from the specific terminal 20, When the transfer rate exceeding the upper limit at the time is confirmed, the traffic related to this communication can be determined to be abnormal, so that unauthorized access can be detected quickly and reliably.

  As described above, according to the present embodiment, whether or not the traffic related to the packet information transmitted from the switch 10 is abnormal is determined based on the index information 442 indicating the characteristics of traffic during normal operation. The transfer speed of the communication port of the switch 10 related to the determined traffic is controlled. Thereby, since it is possible to detect and respond to unauthorized access quickly and reliably, the availability of the system can be maintained.

<Second Embodiment>
Next, a second embodiment of the information system 100 will be described. For simplification of description, the same elements as those in the first embodiment described above are denoted by the same reference numerals, and detailed description thereof is omitted as appropriate.

  FIG. 6 is a diagram showing a procedure of traffic monitoring processing performed in the traffic collection server 40 of this embodiment. The traffic monitoring process of the present embodiment includes the MAC address (MAC_RefAddr) and IP address (IP_RefAddr) of the terminal 20 connected to the specific communication port included in the index information 442, and the number of packets received at the specific communication port. The processing is performed based on the lower limit value (thresh_min_p (PPS) and the lower limit value (thresh_min_b (BPS)) of the transfer rate when a packet is received at a specific communication port. 41 shows processing executed in cooperation with 41 and a predetermined program developed in a RAM (not shown).

  First, when the packet information transmitted from the switch 10 is received via the communication means 48 (step S31), the IP address of the switch 10 from which the packet information is generated and the packet related to the packet information from the packet information. Is acquired (step S32), the MAC address (MAC_Addr) of the terminal connected to this communication port, the IP address (IP_Addr), and the packet received at the communication port Information about the number (Pkts_IN) and the transfer rate (Bytes_IN) is acquired (step S33).

  Next, the specified MAC address (MAC_RefAddr), the specified IP address (IP_RefAddr), the lower limit value of the number of packets (thresh_min_p), the transfer, corresponding to the IP address of the switch 10 and the communication port identification number of the communication port acquired in step S32 A lower limit value (thresh_min_b) of the speed is read from the index information 442 (step S34).

  Subsequently, it is determined whether or not the values of both MAC addresses (MAC_Addr) and (MAC_RefAddr) match each other. If it is determined that they do not match (step S35; No), the process proceeds to step S39.

  On the other hand, if it is determined in step S35 that both MAC addresses match (step S35; Yes), the process proceeds to step S36, and whether or not the values of both IP addresses (IP_Addr) and (IP_RefAddr) match. Is determined, and when it is determined that they do not match (step S36; No), the process proceeds to step S39.

  On the other hand, if it is determined in step S36 that both IP addresses match (step S36; Yes), the process proceeds to step S37, where the number of packets (Pkts_IN), the lower limit of the number of packets (thresh_min_p), and the transfer rate ( Bytes_IN) and the lower limit value (thresh_min_b) of the transfer rate are respectively compared (step S37). Here, when it is determined that the number of packets (Pkts_IN) is equal to or greater than the lower limit (thresh_min_p) of the number of packets and the transfer rate (Bytes_IN) is equal to or greater than the lower limit of the transfer rate (thresh_MIN_b) (step S37; Yes). This process ends.

  In step S37, when it is determined that the number of packets (Pkts_IN) is lower than the lower limit value (thresh_min_p) of the number of packets, or the transfer rate (Bytes_IN) is lower than the lower limit value (thresh_min_b) of the transfer rate (step S37). No), the process proceeds to step S38.

  In step S38, it is determined that the traffic related to the packet information determined in step S35, step S36, or step S37 is abnormal (step S38). Then, instruction information for suppressing or stopping the transfer speed (transfer band) of the communication port is transmitted to the switch 10 having the communication port related to the traffic determined to be abnormal (step S39). ), A screen for notifying that unauthorized access has been made from the terminal 20 connected to the communication port of the switch 10 is displayed on the display means 42 (step S40), and this process ends.

  As described above, in order to determine the abnormality of the traffic related to the packet information based on the information about the communication port of the switch 10, when the number of packets exceeding the upper limit value in the normal operation is transmitted from the specific terminal 20, When the transfer rate exceeding the upper limit of the time is confirmed, it is possible to determine that the traffic related to this communication is abnormal, so that unauthorized access can be detected and dealt with promptly and reliably.

  Note that the switches 10 (switches 10a, 10b, and 10c) from which statistical information is acquired in the traffic monitoring process described above may be sequentially acquired in a predetermined order, or may be acquired simultaneously for all the switches 10. It is good also as an aspect performed. The timing at which the statistical information is acquired can be arbitrarily set.

As described above, according to the present embodiment, whether or not the traffic related to the packet information transmitted from the switch 10 is abnormal is determined based on the index information 442 indicating the characteristics of traffic during normal operation. The transfer speed of the communication port of the switch 10 related to the determined traffic is controlled. Thereby, since it is possible to detect and respond to unauthorized access quickly and reliably, the availability of the system can be maintained.
Note that the order of the determination processes in step S35, step S36, and step S37 is not limited to the above example, and can be performed in any order.

<Third Embodiment>
Next, a third embodiment of the information system 100 will be described. For simplification of description, the same elements as those in the first embodiment described above are denoted by the same reference numerals, and detailed description thereof is omitted as appropriate.

  FIG. 7 is a diagram showing a procedure of traffic monitoring processing performed in the traffic collection server 40 of the present embodiment. The traffic monitoring process of the present embodiment is a threshold value indicating a range between a lower limit value and an upper limit value of the number of packets transmitted and / or received between specific terminals (IP address; IP_RefAddr) included in the index information 442. (Thresh_p_flow (PPS)) is performed based on a threshold (thresh_b_Flow (BPS)) indicating a range between a lower limit value and an upper limit value of a transfer rate when a packet is received between specific terminals. Each process of the traffic monitoring process is a process executed in cooperation with the control unit 41 and a predetermined program developed in a RAM (not shown).

  First, when the packet information transmitted from the switch 10 is received via the communication means 48 (step S51), the IP address of the switch 10 from which the packet information is generated and the packet related to the packet information are received from the packet information. Is acquired (step S52), the IP address (IP_Addr) and the number of packets (Pkts_Flow (PPS) of the source terminal and / or destination terminal of the packet related to the packet information are acquired. )), Information on the transfer rate (Bytes_Flow (BPS)) is acquired (step S53).

  Next, whether or not transmission and / or reception of a packet by the terminal having the IP address (IP_Addr) acquired in step S52 is permitted is determined based on the index information 442, and when it is determined that it is not permitted. (Step S54; No), the process proceeds to Step S57.

  On the other hand, if it is determined in step S54 that it is permitted (step S54; Yes), the threshold of the number of packets transmitted and received between the terminals of this IP address (IP_Addr) (thresh_p_flow), the threshold of the transfer rate ( thresh_b_Flow) is read from the index information 442 (step S55), and the number of packets (Pkts_Flow), the threshold of the number of packets (thresh_flow), the transfer rate (Bytes_Flow), and the threshold of the transfer rate (thresh_b_Flow) are compared (step S56). ). Here, when it is determined that the number of packets (Pkts_Flow) is within the range of the threshold of the number of packets (thresh_p_flow) and the transfer rate (Bytes_Flow) is within the range of the threshold of the transfer rate (thresh_b_Flow) (Step S56; Yes), this process ends.

  In step S56, it is determined that the number of packets (Pkts_Flow) does not fit within the threshold of the number of packets (thresh_p_flow), or the transfer rate (Bytes_Flow) does not fit within the range of the transfer rate threshold (thresh_b_Flow). In the case (Step S56; No), the process proceeds to Step S57.

  In step S57, it is determined that the traffic related to the packet information determined in step S54 or S56 is abnormal (step S57). Then, instruction information for suppressing or stopping the transfer rate (transfer band) of the communication port is transmitted to the switch 10 having the communication port related to the traffic determined to be abnormal (step S58). ) A screen notifying that unauthorized access has been made from the terminal 20 connected to the communication port of the switch 10 is displayed on the display means 42 (step S59), and this process ends.

  In this way, in order to determine traffic abnormality based on the traffic characteristics of each terminal 20 determined in advance within the internal network LAN, when packets are transmitted / received between other than the predetermined terminals 20, When the number of packets exceeding the threshold for normal operation is transmitted between 20 and when the transfer rate exceeding the threshold for normal operation is confirmed between predetermined terminals 20, traffic related to this communication can be determined as abnormal. Therefore, unauthorized access can be detected and dealt with quickly and reliably.

  As described above, according to the present embodiment, whether or not the traffic related to the packet information transmitted from the switch 10 is abnormal is determined based on the index information 442 indicating the characteristics of traffic during normal operation. The transfer speed of the communication port of the switch 10 related to the determined traffic is controlled. Thereby, since it is possible to detect and respond to unauthorized access quickly and reliably, the availability of the system can be maintained.

  The traffic monitoring processing of the first to third embodiments described above is such that the number of packets to be transmitted and received and the transfer rate are uniform to some extent, and packets are transmitted and received only between specific terminals. It is particularly suitable for a plant information system having a static traffic environment. Note that all the traffic monitoring processes of the first to third embodiments may be executed by the traffic collection server 40. In addition, regarding the traffic abnormality determination method in the traffic monitoring process, it is possible to add or change any conditions suitable for the system configuration of the information system 100 as appropriate.

  The application of the present invention is not limited to the example described above, and can be changed as appropriate without departing from the spirit of the present invention.

For example, in the above embodiment, the aspect in which the traffic collection server 40 includes the traffic analysis unit 45, the abnormality determination unit 46, and the abnormality handling unit 47 has been described. However, the present invention is not limited thereto, and the database 441 of the traffic collection server 40 can be connected. The other device may include any or all of the traffic analysis unit 45, the abnormality determination unit 46, and the abnormality handling unit 47.
For example, as shown in FIG. 8, a traffic collection server 40 having a traffic analysis unit 45 and an abnormality determination unit 46 is installed in each of the plurality of internal networks LAN 1 to 3, and the abnormality determination unit 46 of each traffic collection server 40 is installed. The remote monitoring device 50 of the external network WAN may transmit the abnormality determination information indicating the abnormality of the traffic transmitted from the external network WAN. In this case, by providing the remote monitoring device 50 with the abnormality handling means 47, the transfer speed of the switch 10 (not shown) connected to the internal networks LAN1 to 3 according to the abnormality determination information transmitted from the abnormality determination means 46 is set. It can be changed remotely.

  As a result, the same effects as in the above embodiment can be obtained, and a plurality of internal network LAN sites can be simultaneously monitored from the external network WAN, so that the cost for traffic monitoring can be reduced. Become. In particular, in plant information systems related to plant control, there are few specialists related to IP network technology, and there is a fact that incentives for training specialists are difficult to work because it is a non-competitive area for plant operation. Therefore, if anomaly monitoring can be performed remotely, it will be possible to outsource the traffic monitoring business, which will enable cost reduction for the plant operation side and new service business alliance for the traffic monitoring business side. There is an effect.

  In the above embodiment, only the switch 10 generates and transmits the statistical information. However, the present invention is not limited to this, and other network devices such as the router 30 may include the packet sampling unit 11, the packet information generation unit 12, and the like. By providing the packet information transmitting unit 13, another network device may generate and transmit statistical information. For example, as shown in FIG. 9, when a wireless base station 60 that enables communication with each device connected in the internal network LAN by wireless communication is connected to the internal network LAN, this wireless The base station 60 is preferably provided with a function capable of generating statistical information of communication exchanged between the radio base station 60 and a terminal capable of radio communication.

  In addition, when packets are transmitted and received by encrypted communication such as IPSec, the communication port identification number is encrypted, but the TOS (Type Of Service) field of the IPv4 header and the Traffic Class field of the IPv6 header are used. By storing the communication port identification number in this field and transmitting the packet, the traffic collection server 40 can identify the communication port identification number.

It is the figure which showed the structure of the information system. It is the figure which showed the internal structure of the switch. It is the figure which showed the internal structure of the traffic collection server. It is the flowchart which showed the procedure of the packet transfer process. It is the flowchart which showed the procedure of the traffic monitoring process in 1st Embodiment. It is the flowchart which showed the procedure of the traffic monitoring process in 2nd Embodiment. It is the flowchart which showed the procedure of the traffic monitoring process in 3rd Embodiment. It is the figure which showed the structure in the other aspect of an information system. It is the figure which showed the structure in the other aspect of an information system. It is the figure which showed the structure of the conventional information system. It is the flowchart which showed the procedure at the time of detecting unauthorized access by a firewall in the conventional information system. It is the flowchart which showed the procedure at the time of detecting unauthorized access by each terminal in the conventional information system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Information system 10 Switch 11 Packet sampling means 12 Packet information generation means 13 Packet information transmission means 14 Switching means 20 Terminal 30 Router 40 Traffic collection server 41 Control means 42 Display means 43 Operation means 44 Storage means 441 Database 442 Index information 45 Traffic analysis Means 46 Abnormality determination means 47 Abnormality correspondence means 48 Communication means 49 Control bus 50 Remote monitoring device 60 Wireless base station FW Firewall LAN, LAN1, LAN2, LAN3 Internal network WAN External network

Claims (7)

Switching means for transferring packets transmitted from one or a plurality of terminals respectively connected to a plurality of communication ports to other terminals, packet information generating means for generating packet information relating to the transmitted packets, and the generated An information system comprising: a network device provided with packet information transmitting means for transmitting the packet information; and a traffic collection server for storing packet information transmitted from the network device,
The collection server stores index information storage means for storing index information indicating characteristics of traffic during normal operation, and traffic related to the packet information based on the stored index information and the received packet information. An abnormality determination unit that determines whether or not there is an abnormality, and an abnormality response that generates instruction information for changing the transfer speed of the communication port of the network device related to the traffic determined to be abnormal by the abnormality determination unit, and transmits the instruction information to the network device Means, and
The transfer means controls the transfer speed of the communication port indicated by the instruction information based on the instruction information from the abnormality handling means.   The information system according to claim 1, wherein the collection server includes a traffic analysis unit that generates the index information from the stored packet information and stores the index information in the index information storage unit.   The packet information includes identification information of a network device that has generated the packet information, identification information of a communication port in which the packet is transmitted and / or received in the network device, identification information of a transmission source terminal and a reception destination terminal of the packet, 3. The packet size of the packet, header information included in a header portion of the packet, a time stamp indicating a generation date and time of the packet information, and information regarding a protocol type of the packet are at least included. The described information system.   The index information includes an upper limit value and / or a lower limit value of the number of packets transmitted and / or received at a specific communication port in the network device, and a transfer rate when packets are transmitted and / or received at the specific communication port. 2. The information system according to claim 1, comprising any one or all of an upper limit value and / or a lower limit value and identification information of the terminal connected to a specific communication port.   The index information includes an upper limit value and / or a lower limit value of the number of packets transmitted and / or received between specific terminals among the plurality of terminals, and packets are transmitted and / or received between the specific terminals. 5. The information system according to claim 1, wherein the information system includes any or all of an upper limit value and / or a lower limit value of the transfer rate.   6. The information according to claim 1, 4 or 5, wherein the index information includes a setting related to transmission and / or reception of the packet that is predetermined between specific terminals among the plurality of terminals. system. The network device comprises a packet sampling means for extracting one packet from a packet transmitted from the terminal at a predetermined timing,
The information system according to claim 1, wherein the packet information generation unit generates packet information of the extracted packet.

Images